SQMS 1 in Practice: Turning Monitoring and Remediation into Action

The introduction of SQMS 1 has required firms to take a hard look at how they manage and monitor quality.  The standard establishes a risk-based framework that requires evidence that a firm’s system of quality management (SOQM) is operating effectively.

While the principles of SQMS 1 are clear, the practical side, how to actually make it work in your firm,  can feel daunting. Having supported firms implementing ISQM 1 and SQMS 1 on their own quality journeys, we’ve seen where multiple approaches with some strong overlap irrespective of firm size.

This blog suggests some simple, practical actions any firm, large or small, can take as part of bringing their Monitoring framework into operation. 

Understanding the Requirements

At its core, SQMS 1 requires firms to design, implement, and operate a system of quality management that provides reasonable assurance that a firm’s quality objectives are met through the operation of their system of quality management.

Under this framework, Monitoring and Remediation play a critical role. Firms must:

• Design and perform monitoring activities that evaluate whether the SOQM is operating effectively.

• Identify and evaluate findings that arise from that monitoring.

• Evaluate Identified deficiencies through a root cause analysis

• Respond appropriately to those deficiencies through timely remediation.

• Communicate results and insights across the firm to ensure a cycle of continuous improvement.

• Perform an annual evaluation of the system’s overall effectiveness, supported by relevant, reliable, and timely (RRT) information.

  
  

In practice, this means firms need a monitoring framework that allows them to gather evidence, assess results, remediate deficiencies continuously—not just once a year.

Practical Step 1: Define Your Monitoring Population

A common pitfall is starting monitoring activities without a clear view of what you’re actually monitoring.

Every firm’s quality risks and responses will look different, so begin by defining your monitoring population—the universe of policies, processes, controls, and engagement files where any identified deficiency may result in the quality objective not being met.

When considering these think about:

• Responses that operate by exception as they may not need monitoring in a period;

• Responses which operate based on a time criticality – if they operated in January, monitoring them in December may not give you enough time to remediate issues;

• Responses by component – some entities may choose to focus on cruciate components of their organisation like governance & leadership;

• Risks which represent significant risk in the operation of the system;

• Responses which have been changed or newly implemented; and

• Engagement files based on a mix of engagements and engagement partners aligned to your internal engagement file review response.

Practical Step 2: Align Your Testing Approach

Once the population is defined, focus on how you’ll test a response.  The standard requires firms to consider the design, implementation and operation as part of their testing.

So, a good starting point is to perform walkthrough tests of a response, this informs you if:

• it’s been designed and implemented as intended;

• Who is the owner of response and how it is operated by them; and

• Document what evidence is available to supports the operation of that control.

  
  

Based on the walkthrough you will be able to define your testing plan, but rest assured, it will still need to evolve and develop over time.

Practical Step 3: If the Process matches your Firm’s Scale, so should your testing

Take a simple example of a weekly management meeting, where prospective clients or new engagements are discussed with the aim of raising any conflict issues.  All managers attend and the agenda includes a standing item to cover the discussion of new leads. 

However, if we consider the implementation of this in a 100-partner firm versus a 3-partner firm the evidence and testing we get will be different and the nature, timing and extent of the testing reflects it. 

For example, the evidence in a larger firm may be more structures including formal minutes, an action tracker which is managed as part of the meeting, and a summary email sent to all managers to allow individuals who didn’t attend see the discussion items.   So, testing could:

• Start by selecting a meeting;

• Reviewing the minutes and discussion on new clients;

• Reviewing the action and tracing the completion to evidence of the output etc.; and

• Recomplete the steps for all clients noted as part of the single meeting.

  
  

In smaller firms, discussions may be less formal, with no minutes or actions tracking and evidence of decisions being capture after the meeting as part of acceptance documents or engagement files.  So, testing could:

• Select a sample of a new client and / or a client that was not accepted; and

• Trace evidence of the discussion to the acceptance memo in both cases. 

  
  

The key is consistency and clarity of process and evidence—whatever process your firm adopts should be documented and repeatable allowing for the monitoring.

Practical Step 4: Turn Findings into Improvements

Monitoring doesn’t end with identifying findings or deficiencies; it’s about what you do with these, and the standard requires us to act and remediate our deficiencies.  However, it also looks for us to consider the positive findings we find in the system.

Firms should be looking for these positive findings in terms of outcomes, or good practices which could be applied across your business, for example approaches to documenting actions from meetings may be inconsistent across different teams and responses, a findings or gap in one response could be easily removed by applying the approach from another.

Regularly communicate outcomes with leadership, monitoring teams and the wider firm & engagement teams. This transparency reinforces accountability and helps embed a culture where findings are identified as opportunities to strengthen quality, not only as issues.

Practical Step 5: Make It Work Day-to-Day

Successful SQMS 1 implementation isn’t about building the perfect system on day one—it’s about creating a repeatable process that evolves.

The more you integrate monitoring and remediation into your normal day to day activities and the less it is considered like a separate annual exercise the better the outcomes for your system as a whole.

SQMS 1 isn’t just a regulatory requirement—it’s an opportunity to strengthen how firms deliver quality, manage risk, and build trust.